Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

HKEY_CURRENT_USER\Software\Wow6432Node\Classes vs HKEY_CURRENT_USER\Software\Classes\Wow6432Node

Tags:

registry

wow64

The question is very simple, what's the difference between HKEY_CURRENT_USER\Software\Wow6432Node\Classes and HKEY_CURRENT_USER\Software\Classes\Wow6432Node?

like image 367
Román Avatar asked Oct 14 '10 18:10

Román


1 Answers

rather late, but here I go

Colin O'Dell writes:

I'm not sure, but I can tell you that my Windows 7 x64 machine only has the latter one. I do have HKEY_CURRENT_USER\Software\Wow6432Node\, but Classes doesn't exist inside that for me.

And you shouldn't have, HKCU is actually pointer to -> HKUS\UserSid

Now HKCU\Software\Classes is actually pointer to -> HKUS\UserSid\Software\Classes, and this one is actually pointer to HKUS\UserSid_Classes

Now here comes WOW redirection, and for example HKCU\Software\Classes\CLSID becomes: HKUS\UserSid_Classes\Wow6432Node\CLSID

ain't that fun?

So in short, HKEY_CURRENT_USER\Software\Wow6432Node\Classes is most-likely a leftover after some misbehaving application (that was probably trying to figure out redirection by itself...)

jp2code writes:

We have hundreds of WinXP machines at our workplace still. Classes is installed on all of them, but not Wow6432Node

Weren't you perhaps speaking about 32-bit Win XP? if so, it's quite obvious, there's no Wow node...

like image 105
GiM Avatar answered Sep 28 '22 06:09

GiM